Concrete CMS versions prior to 9.5.2 are vulnerable to PHP Object Injection through unserialize() calls in several components, namely Workflow, Form block, and File/Set. An unauthenticated attacker who manages to inject a malicious serialized payload into the database can trigger arbitrary instantiation of PHP objects, which may lead to arbitrary code execution and full compromise of the system. This flaw is a classic case of unsafe deserialization (CWE‑502) that bypasses the allowed_classes restriction normally intended to restrict the classes that can be unserialized.

The vulnerability applies to Concrete CMS installations running any version before 9.5.2. Users of the open‑source CMS must verify whether their instance is below this version and, if so, consider upgrading or applying remediation measures.

The CVSS score of 8.4 points to a high‑severity flaw that is relatively easy to exploit with low attack effort (AV:L, AC:L, AT:N). Because the attack does not require special privileges or an interactive user interface, the risk remains significant. The flaw is not listed in CISA’s KEV catalog, so no public exploit has been reported yet, yet the nature of PHP object injection means an attacker can instantiate arbitrary objects and execute arbitrary code once a malicious payload is present in the database. EPSS data is not provided, so the exploit likelihood cannot be quantified.